The EU high-risk third-country list: how it drives your risk scoring

Every Irish firm's AML policy says something about "high-risk jurisdictions", and in a surprising number of firms that is where the thinking stops — a phrase in a document, connected to nothing. The EU maintains an actual list of high-risk third countries, it changes over time, and both the current Irish framework and the AMLR that applies from 10 July 2027 expect connections to those countries to change how you treat a client. If your risk-scoring model cannot say which countries it treats as high-risk and why, this is the gap to close before the AMLR arrives.

What is the EU high-risk third-country list?

The European Commission identifies third countries — countries outside the EU — whose AML and counter-terrorist-financing regimes have strategic deficiencies, and lists them in a delegated regulation that is updated periodically. The consolidated legal texts are available through EUR-Lex. The practical consequence for obliged entities is straightforward: business relationships and transactions involving listed countries call for enhanced due diligence, not standard treatment.

Two operational points follow. First, the list changes — countries are added and removed as their regimes are assessed — so a country list hard-coded into a policy document in 2024 may already be wrong. Second, the list is a floor, not a ceiling: your own risk assessment can and should treat additional geographies as elevated where your experience or your sector guidance says so, even if they are not on the EU list.

Where does geography belong in a client risk score?

Geography is one of the classic risk dimensions — alongside client factors, the service provided and the delivery channel — and the mistake most small firms make is scoring only the client's home address. A client's geographic risk surface is wider than where they live. When you score a client, look at:

• Residence and establishment — where the client, and for companies the beneficial owners, are based.
• Source and destination of funds — where the money comes from and where it is going, which in property and corporate work is often more revealing than the client's address.
• Counterparties and structure — where the other side of the transaction sits, and where any intermediate entities in an ownership chain are incorporated.
• The client's own footprint — where they do business, not just where they are registered.

A single connection to a listed country should not silently average away inside a weighted score. The cleaner design is an override: any high-risk third-country connection lifts the client to your enhanced tier regardless of how benign every other factor looks, and the file records what enhanced measures followed.

What does enhanced due diligence actually mean in practice?

Enhanced due diligence is more depth, more corroboration and more senior eyes — proportionate to the reason it was triggered. For a small firm, that typically means: additional verification of identity and beneficial ownership; real information on source of funds and source of wealth rather than a ticked box; senior approval before the relationship starts or continues; and closer, more frequent ongoing monitoring. The AMLR harmonises EDD expectations EU-wide, and some of the final detail will be shaped by AMLA's technical standards and guidance — where a point of detail is still landing, anchor your procedures in the regulation's text and note the dependency rather than inventing specifics. Track AMLA for what is settled.

How do you keep the list from going stale in your firm?

The list is only useful if the version your staff apply is the current one. Practical habits that work at small-firm scale:

1. Name an owner. Someone — realistically your MLRO or compliance officer — owns "the list is current" as a task, with a periodic check diarised.
2. Keep one source of truth. One maintained reference in your systems, not per-person copies pasted into old templates.
3. Re-screen on change. When the list changes, sweep your existing client base for new matches — a country added to the list turns yesterday's standard-risk client into today's EDD case.
4. Record the version. When a client is scored, note the list version or date applied, so a file review can reconstruct why the rating was right at the time.

A purely hypothetical illustration: a Dublin accountancy practice onboards a trading company whose ultimate owner lives abroad in a country later added to the EU list. The firm that re-screens on list changes catches it within the month, moves the client to its enhanced tier and documents the review. The firm that scored geography once, at onboarding, finds out during an inspection instead.

What to do now

1. Find out what your current policy actually says about high-risk countries, and whether it points to a maintained list or a stale snapshot.
2. Add the EU high-risk third-country list as an explicit input to your client risk model, with an override to the enhanced tier.
3. Widen geographic scoring beyond residence: source and destination of funds, counterparties, ownership chains.
4. Diarise a periodic list check and a re-screen of the client base whenever the list changes.
5. Write down what your enhanced tier requires, so EDD is a defined process rather than an improvised one.

Where CompliDesk fits

CompliDesk Ireland treats the EU high-risk third-country list as a live risk-scoring input, so listed-country connections flag automatically in client onboarding and reviews. The right foundation is a risk model your whole firm shares — start with our business-wide risk assessment guide.